The short version.

We keep the least we can, for the shortest time we can, to run one whitelist. No ads. No analytics. No selling your data. Last updated 30 September 2026.

What we keep when you join

• Your X handle and your wallet address, because that is the whitelist.
• Your story and a link to your quote or reply, only if you choose to write them.
• Which tasks you ticked, and when you sent the form.
• A scrambled version of your network address (a salted hash, never the address itself) and a short browser label, cut to 120 characters. They exist only to stop bots and repeat entries.
• If you use the optional Connect X button: your X username, your numeric X account ID, the date the account was created and its follower count. Never a password, never permission to post, follow or message.

What we do not keep

• No private keys, seed phrases or signatures. The form never asks for them and never asks you to connect a wallet.
• No advertising trackers and no analytics scripts on this site.
• Nothing about what you do on X. The task buttons open x.com in a new tab, and from there X's own rules apply. We only know what you tell us by ticking the boxes.

Why, and on what basis

To run the whitelist you asked to join (your consent, which you give by ticking the box, and which you can withdraw). To keep bots and duplicates out and to check entries (our legitimate interest in a fair list).

Who else handles it

Hosting, the database that stores the list (Cloudflare D1) and the security check (Cloudflare Turnstile) are provided by Cloudflare, which processes data on our behalf. Their notice is at cloudflare.com/privacypolicy. The security check may use your browser's storage to tell people from bots. We do not pass your data to anyone else.

How long

The hashed network address and browser label are deleted 30 days after the whitelist closes. The rest of your entry is kept until the mint has happened and the list has been used, and deleted no later than 90 days after that. If the collection never mints, we delete the list within 12 months of it closing.

Your choices

You can ask to see, correct or delete your entry, to restrict how we use it, or to object, at any time. If you are in the EU or the UK these are your rights under the GDPR. Message @0ops_xyz on X from the account you signed up with (we never message first) and we will act within one month. You can also complain to your local data-protection authority.

Cookies and browser storage

The site sets no tracking cookies. Your browser keeps two small notes on your own device only: a draft of the form (so a page reload does not lose it) and a flag that you have already joined. Clear your site data to remove them. If Connect X is switched on, a short-lived, secure cookie (about two hours) holds your connected X username until you send the form or disconnect.

Changes

If this changes in a way that matters, the date at the top changes and we say so on @0ops_xyz.